I think the problem would be in your Expect line:
Expect=HTTP/1.1 200 OK
The first problem with this is that it is missing an operator such as "Contains" or
"Starts With". What this Expect Line is looking for is an HTTP response header, so
"starts with" would be appropriate. Thus:
Expect=^HTTP/1.1 200 OK
Now, this might be sufficient to get rid of the false positives. It depends on how
the server actually responds to an invalid request. ie, does it give a 200 response?
For instance, when I request an invalid page from many web servers I get an HTTP
response with a 404 code (Not Found). A 404 reponse is not a 200 response and the
Expect statement used above would fail. However, many web servers will respond by
serving up a webpage that explains that the page was not found and perhaps gives a
whole pile of extra info (link to search page, etc). The thing is, in serving up
this page, the HTTP Header was not a 404 response.. it was 200. Thus, the Expect
statement returns TRUE and you think the webpage is there when it is not there at all.
The solution is pretty easy. It's to view the webpage for www.MYVirtual.site.COM
using your web browser, examine the source for the page, and choose some text that
uniquely identifies the page. Then construct an Expect statement that looks for that
text. Because the text is unique it should not be in the response to any other queryy
to that IP, be it for a valid (but incorrect) domain, or a domain that does not
exist at that IP.
Let me know how you get on. If you come right then I will make sure that:
http://support.ipswitch.com/kb/WG-20010425-DM01.htm
..is updated.
Mark Symons
Ipswitch, Inc
Augusta GA
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Sam McKenzie
Sent: Thursday, July 15, 2004 15:26
To: '[EMAIL PROTECTED]'
Cc: Charles Alexander
Subject: [WhatsUp Forum] Not so White Paper: HTTP Content check to monitor dynamic web
ser versz
Question/Problem: How do I do HTTP Content check to monitor dynamic web servers?
I found the white-paper that should have helped. It does not.
I can actually put any false hostname/dynamic site in place of the
www.MYVirtual.site.COM and the service still shows as being up! It seems to accept ANY
name. It does not matter what you put in there.
Is something wrong with the syntax in the document?
Here is the white paper from ipswitch:
White Paper Solution -
Some web servers that host multiple domains on one server use content within the
HTTP headers to identify which site the user wants. To do this, you would have to
create a custom monitor to specifically monitor that one site. The pertinent
information to accomplish this would be
"Host: www.yoursite.com" where yoursite.com represents the dynamic site.
Here is the line you would enter in the Send Command on Connect field:
GET / HTTP/1.1\r\nHost:www.yoursite.com\r\nUser-Agent:Ipswitch_Whatsup/5.0\r\n\r\n
For versions 7 or later, use the following script:
Send=GET / HTTP/1.1\r\nAccept:
*/*\r\nHost:www.MYVirtual.site.COM\r\nUser-Agent:Ipswitch_Whatsup/7.0\r\n\r\
n
Expect=HTTP/1.1 200 OK
Note: You will be sending 2 lines; the Send and the Expect. So, it is important that
the SEND line is one line in the Script body of the service and the Expect is the
second line.
You could copy the service example (Dynamic Site) directly into the SERVICES.INI file
located in your Whatsup directory. And change the "www.MYVirtual.com" to your Host.
Send=GET / HTTP/1.1\r\nAccept:
*/*\r\nHost:www.MYVirtual.site.COM\r\nUser-Agent:Ipswitch_Whatsup/7.0\r\n\r\
[Dynamic Site]
CLSID={72B6D231-D71E-11d2-8F74-0040054D7C1D}
Lines=2
Line000=Send=GET / HTTP/1.1\r\nAccept:
*/*\r\nHost:www.MYVirtual.com\r\nUser-Agent:Ipswitch_Whatsup/8.0\r\n\r\n
Line001=Expect=HTTP/1.1 200 OK
TYPE=0
PORT=80
TIMEOUT=15
Send=GET /about.html HTTP/1.1\r\nAccept:
*/*\r\nHost:www.MYVirtual.site.COM\r\nUser-Agent:Ipswitch_Whatsup/8.0\r\n\r\
n
Expect=HTTP/1.1 200 OK
If you want to check for a sub page on the Host, like "about.html" for instance then
the script will look like this:
Send=GET /about.html HTTP/1.1\r\nAccept:
*/*\r\nHost:www.MYVirtual.site.COM\r\nUser-Agent:Ipswitch_Whatsup/8.0\r\n\r\
n
Expect=HTTP/1.1 200 OK
(Notice the "about.html" is placed behind the "GET /...")
NOTE: If ICMP is blocked to the web server, i.e. you cannot ping the Host, then choose
Polling Method: TCP/IP (or in version 8 you would choose Services).
Thanks!
Charles R. Alexander
System Administrator
Quantum Corporation
719-536-6405
8301-6405
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Anthony Franklin
Sent: Friday, June 18, 2004 10:06 AM
To: [EMAIL PROTECTED]
Subject: RE: [WhatsUp Forum] HTTP Content Scan when Web Sites use the same IP
Good Morning Charles,
I am surprised. I know what you are talking about. There is a way to fix that. Mike
Patterson of Somix published a document a few years ago that illustrates how to do
http content scans in detail. You might want review that document. It might be in
the Ipswitch knowledge base. That should solve that issue.
If it does not, you can try the alternate solution.
Anthony Franklin, Network Engineer
Information Technology Services
University of West Florida
Pensacola, Florida 32514
850.474.3243
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Charles Alexander
Sent: Friday, June 18, 2004 10:00 AM
To: '[EMAIL PROTECTED]'
Subject: RE: [WhatsUp Forum] HTTP Content Scan when Web Sites use the same IP
I am not getting an error. If I use the site name, it still just looks at the IP
address and checks the default page instead of the website I want to check.
Thanks!
Charles R. Alexander
8301-6405
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Anthony Franklin
Sent: Thursday, June 17, 2004 4:34 PM
To: [EMAIL PROTECTED]
Subject: RE: [WhatsUp Forum] HTTP Content Scan when Web Sites use the same IP
Try using the site name.
If the sites do redirects that keep returning an error, send me a message and I will
share a solution. It will require installing a 500k language on the WUG server or any
server you like, for that matter (any development web server is fine, and all you will
have to do is reference it from the What's Up Gold server. You don't have to install
it actually; you will only need to copy it to a folder of your choice.
The same thing can be done with Perl; But You will have to figure it out.
It creates a static html file of whatever site you are referencing every poll. You
choose wherever you want to store the file (in a "static" web folder that will not be
a redirect). On each poll, it overwrites that previously produce static page to give
you exactly what a user will see in a browser during that poll cycle.
So if your production site does not display the content, the reproduced page does not
display the content either. If your production site displays the content, the
reproduced page will display the content and your scan passes successfully.
You can place all of your sites in the same folder. The reproduced page for each site
needs to have a different name.
The language is called Rebol -- Pronounced like Rebel.
www.rebol.com
I will then pass my script to you. The script is a flat text file.
Several months ago I said it would support https scans, but I was incorrect. So, you
need to make a http connection available to your what's up gold server. If the site
requires https, allow http for your what's up gold server only in the IIS IP security
of your Production web server.
I have not checked to see if there is a new version of rebol that supports https.
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Charles Alexander
Sent: Thursday, June 17, 2004 4:57 PM
To: '[EMAIL PROTECTED]'
Subject: [WhatsUp Forum] HTTP Content Scan when Web Sites use the same IP
Hi!
How can I do an HTTP Content Scan on Web Sites when they are all using the same IP
address?
Thanks!
Charles R. Alexander
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/
